Steeltoe Management CVE-2026-50194

The target application must be running Steeltoe Management 3.2.2-3.3.0 or 4.1.0 with the Management:Endpoints:Port configuration key set to a value different from the main application port (i.e., the alternate-management-port deployment pattern). Exploitation is limited to environments where no upstream proxy normalizes the Host header and where actuator endpoints are not independently protected by ASP.NET Core authorization; deployments that leave actuators on the default in-process port, or that already require authentication on actuator routes, are not vulnerable to this specific bypass. No user interaction, no authentication, and no special platform privileges are required beyond network reachability of the public HTTP listener.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (8.2 High) accurately reflects a network-reachable, unauthenticated, single-request bypass with high confidentiality impact (actuators frequently expose environment variables, configuration, heap dumps, and trace data) and limited integrity impact (some actuators allow state changes such as log-level adjustments). Real-world risk is meaningful but conditional: the bug only manifests when an operator has actually configured Management:Endpoints:Port to isolate actuators on an alternate port, which is the very pattern security-conscious deployments adopt - so the affected population is precisely those who tried to harden. No EPSS, KEV, or SSVC data was provided; exploitation status is no public exploit identified at time of analysis, though the public regression test in the fix commit is effectively a working PoC for the spoof. Defenders relying solely on network segmentation of the management port should treat this as priority patching, since the very control they trust is the one that fails.

An attacker who can reach the application's public HTTP port sends a normal GET to /actuator/env (or any other sensitive actuator path) while setting the Host header to host:9090, where 9090 is the configured management port. The middleware parses the spoofed port from the Host header, concludes the request arrived on the management port, and serves the actuator response over the public socket - leaking environment variables, configuration, and other sensitive runtime data. The public patch commit ships a regression test that performs exactly this spoof, providing a ready-made proof of concept.